postauthenticationflows using OR condition

[Cantor, Scott]

> Just wondering whether its possible to OR a postauthenticationflow. I can
> AND them using the following

The interceptor mechanism runs named flows sequentially until one fails the request or there aren't any more, and that's all it can do.

> What I want to do is give access if they are an "affiliate" or "member".
> There are other sites where only "members" or "affiliates" can access.

I suggest you manage an attribute in a directory or database reflecting the appropriate policies and just check for the attribute, and not stick all that business logic inside the IdP. Worst case you could create a table mapping SPs to permissions, and resolve an attribute at runtime based on the SP so that a flow like the context-check can just check for the result.

> Do I need to create a separate intercept checking for either member or
> affiliate as below

There are many ways to do it, multiple flows, compound predicate logic that combines the SP name with various attribute checks in a nested boolean mess, and probably others, but I wouldn't use any of them.

-- Scott